REST API Guide

1. Authenticate with an API key

In your OpexMX instance, go to Settings → API Keys and create a key (mx_…). Send it as a Bearer token on every request. The key carries the permissions of the user who created it, so create it under a role with only the access your integration needs. Expired or revoked keys answer 401.

curl "https://<your-instance-domain>/api/rpc/assets?limit=5" \
  -H "Authorization: Bearer mx_your_api_key"

2. Use your tenant’s base URL

There is no shared global API host: each tenant is served from its own domain (for example https://acme.opexmx.com, or your on-prem host). All paths start with /api.

• OpenAPI document: https://<your-instance-domain>/api/openapi.json
• Interactive reference (Scalar UI, with “try it out”): https://<your-instance-domain>/api/openapi

Feed the OpenAPI document to any generator (openapi-typescript, openapi-generator, …) to produce a client in your language.

3. TypeScript SDK

@opexcg/opexmx-sdk is a typed client generated from the OpenAPI spec: every path, query parameter, request body and response is checked by the compiler. It adds API-key auth and tenant base URL handling on top of openapi-fetch. It is not published to npm yet; build it from the sdk/ folder of the OpexMX repository.

# Not on npm yet — build it from the opexmx-app repo (sdk/)
cd sdk && bun install && bun run build && npm pack
npm install ./opexcg-opexmx-sdk-0.1.0.tgz

import { createOpexmxClient } from '@opexcg/opexmx-sdk'

const opexmx = createOpexmxClient({
  baseUrl: 'https://<your-instance-domain>',
  apiKey: process.env.OPEXMX_API_KEY!, // mx_your_api_key
})

const { data, error, response } = await opexmx.GET('/api/rpc/assets', {
  params: { query: { limit: 20, search: 'pump' } },
})
if (error) throw new Error(`HTTP ${response.status}`)

4. Rate limits

Limits are per API key: 600 requests per 60 seconds by default, shared across the REST API and the MCP endpoint. Self-hosted deployments can change the limit. When a key exceeds it, the API answers 429 with a Retry-After header (seconds) — wait that long, then retry.

HTTP/1.1 429 Too Many Requests
Retry-After: 12
X-RateLimit-Limit: 600
Content-Type: application/json

{"error":"Too many requests"}

5. AI agents (MCP)

The same API key also connects AI assistants to your instance over MCP at /api/mcp. See the MCP setup guide.